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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 
Patent Application 

5 Applicant(s): Ca et al 

Case: 3-2 ' 

Serial No : 09/876,568 

Filing Date: June 7, 2001 

Group: 2134 

10 Examiner: Pioti Poltorak 

Title: Method and Apparatus for Protecting a Device Connected to a Netwoik 



15 

REPLY BRIEF 

Mail Stop Appeal Brief - Patents 
Commissioner for Patents 
20 P.O.Box 1450 

Alexandria, VA 22313-1450 



Sir: 

25 

Appellants hereby reply to the Examiner's Answer, mailed January 30, 2007 
(referred to hereinafter as "the Examiner's Answer''), in an Appeal of the final rejection of 
claims 1-32 in the above-identified patent application 



30 REAL PARTY IN INTEREST 

A statement identifying the real party in interest is contained in Appellants' 

Appeal Brief . 



RELATED APPEALS AND INTERFERENCES 
35 A statement identifying related appeals is contained in Appellants' Appeal Brief. 



STATUS OF CLAIMS 
A statement identifying the status of the claims is contained in Appellants' Appeal 
Brief Claims 1-3, 12-14, 17-19, 22-24, .31, and .32 are being appealed. 
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STATUS OF AMENDMENTS 
A statement identifying the status of the amendments is contained in Appellants' 

Appeal Brief. 

5 SUMMARY OF CLAIMED SUBJECT MATTER 

Ihe present invention is directed to a method (FIG 1: 300) and apparatus for 
detecting the removal of a device (FIG. 1: 110) connected to a network (FIG., 1: 100)., The 
present invention generates an alarm on a protected device (FIG. 1: 110) when an unauthorized 
user disconnects the device (FIG. 1 : 110) fiom a network (F IG. 1 : 100) connection. (Page 2, line 

10 24, to page 3, line 27.) The network (FIG 1: 100) connection is monitored and an alarm is 
generated if the protected device (FIG 1: 110) is disconnected from the network (FIG., 1: 100) 
connection without proper notification to the theft protection utility (FIG 1: 300). (Page 4, line 
8 ? to page 5, line 29.) A number' of fail-safe features can optionally be employed to ensure that 
the theft protection aspects of the present invention are not bypassed. For example, the theft 

15 protection utility process can employ speaker, volume and/or power control features to ensure 
that the alarms generated by the present invention, or the theft protection feature itself, cannot be 
bypassed (Page 4, line 24, to page 5, line 12.) In particular, the present specification discloses 
monitoring a network (FIG. 1: 100) connection (page 5, lines 13-29); and generating an alarm in 
a removed device (FIG. 1: 110) if the network (FIG. 1: 100) connection is disconnected (page 5, 

20 lines 25-29), discloses sending a message to a second device (FIG 1: 110) connected to a 
network (FIG. 1: 100) that will initiate a response; and generating an alarm in a removed device 
(FIG 1: 110) if a response is not received within a predefined time interval (page 5, lines 13-29), 
and discloses monitoring a signal received on a network (FIG, 1: 100) connection fiom a remote 
device (FIG. 1: 120) over the network (FIG. 1: 100) connection; and generating an alarm in a 

25 removed device (FIG. 1 : 110) if said signal is no longer received (page 5, lines 13-29) 

Independent claim 1 is directed to a method (FIG 1; 300) for 1 detecting removal 
of a device (FIG. 1: 110) connected to a network (FIG. 1: 100) by a network (FIG. 1: 100) 
connection, comprising: monitoring said network (FIG. 1: 100) connection (page 5, lines 13-29); 
and generating an alarm in said removed device (FIG 1: 110) if said network (FIG. 1: 100) 

30 connection is disconnected (page 5, lines 25-29) . 
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In one exemplaiy embodiment, the volume of an audio output of said device 
(FIG. 1: 110) is prevented from being reduced below a predefined minimum level (page 5, lines 
6-7). 

In another exemplary embodiment, the device (FIG, 1: 110) is prevented from 
being turned off (page 5, lines 8-1 1), 

Independent claim 12 is directed to a method (FIG. 1: 300) for detecting removal 
of a device (FIG, 1: 110) connected to a network (FIG 1: 100) by a network (FIG. 1: 100) 
connection, comprising: sending a message to a second device (FIG 1: 120) connected to said 
network (FIG 1: 100) that will initiate a response; and generating an alarm in said removed 
device (FIG,. 1: 110) if said response is not received within a predefined time interval (page 5, 
lines 13-29), 

Independent claim 17 is directed to a method (FIG. 1: 300) for detecting removal 
of a device (FIG, 1: 110) connected to a network (FIG. 1: 100) by a network (FIG, 1: 100) 
connection, comprising: monitoring a signal received on said network (FIG 1: 100) connection 
from a remote device (FIG. 1: 120) over said network (FIG 1: 100) connection; and generating 
an alarm in said removed device (FIG. 1: 110) if said signal is no longer received (page 5, lines 
13-29).. 

Independent claim 22 is directed to a system for detecting removal of a device 
(FIG 1: 110) connected to a network (FIG. 1: 100) by a network (FIG. 1: 100) connection, 
comprising: a memory that stores computer -readable code; and a processor operatively coupled 
to said memory, said pr ocessor configur ed to implement said computer -r eadable code, said 
computer-readable code configured to: monitor said network (FIG, 1: 100) connection (page 5, 
lines 13-29); and generate an alarm in said removed device (FIG., 1: 110) if said network (FIG 1: 
100) connection is disconnected (page 5, lines 25-29), 

Independent claim 31 is directed to an article of manufacture for detecting 
removal of a device (FIG. 1: 110) connected to a network (FIG. 1: 100) by a network (FIG,, 1: 
100) connection, comprising: a computer 1 readable medium having computer readable code 
means embodied thereon, said computer readable program code which when executed 
implements the steps of: a step to monitor said network (FIG, 1: 100) connection (page 5, lines 
13-29); and a step to generate an alarm in said removed device (FIG. 1: 110) if said network 
(FIG 1: 100) connection is disconnected (page 5, lines 25-29)., 
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Independent claim 32 is directed to a system for detecting removal of a device 
(FIG. 1: 110) connected to a network (FIG, 1: 100) by a netwoik (FIG 1: 100) connection, 
comprising: means for monitoring said network (PIG. 1: 100) connection (page 5, lines 13-29); 
and means for generating an alarm in said removed device (FIG. 1: 110) if said netwoik (FIG. 1: 
5 100) connection is disconnected (page 5, lines 25-29). 

STATEMENT OF GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

A statement identifying the grounds of rejection to be reviewed on appeal is 
contained in Appellants' Appeal Brief , 

10 

CLAIMS APPEALED 
A copy of the appealed claims is contained in an Appendix of Appellants' Appeal 

Brief 

15 ARGUMENT 

In the Response to Arguments section of the Examiner 's Answer (pages 9-10), the 
Examiner notes that the phrase "indication of theft" is not present in the independent claims 

Appellants note, however, that the present claims are not only directed to 
detecting the disconnect of a network connection, but ar e also directed to detecting the "removal 

20 of a device/' as r ecited in the independent claims In the context of the pr esent invention, the 
detection of the removal of a device is indicative of a theft of the device. The Examiner's 
definition of an alarm (cited fiom the Computer Dictionary) may be appropriate for use in the 
context of the invention disclosed by Thunott (since Thuir ott is dir ected to alerting a "user when 
the machine is disconnected from the network"), but is not appropriate in the context of the 

25 present invention., (See, Netwoik Disconnect Cue section ) As previously noted, however ? a 
visual cue, as taught by Thuir ott, that alerts a user of a machine is unlikely to be ef fective as an 
alarm to alert one or more individuals to a theft, as would be apparent to a person of ordinary 
skill in the art As noted above, the present invention is directed to theft protection, and is thus 
not directed to providing an alarm to the person in possession of the device, but is directed to 

30 provide an alarm to, for' example, other persons, Thus, an appropriate definition of an alarm in 
the context of the present invention is "an automatic device that serves to call attention, to rouse 
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from sleep, or to warn of fire, smoke, an intruder, etc. 33 (See, dictionary.com) Thus, a person of 
oidinaiy skill in the ait would not interpret the visual cue disclosed by Thunott as an "alarm for 
indicating removal of a device. 99 

In the Response to Arguments section of the Examiner's Answer dated January 
5 30, 2007, the Examiner 1 asserts that the definition cited in the Computer Dictionary is consistent 
with common interpretation in the ait (Shimizu et al„, Low, and Kimuia)., Appellants note that, 
as is the case with the Thurott reference, these patents are directed to generating an alaim for 1 a 
user 1 of a machine who is in possession of the device,, For' example, a person of ordinary skill in 
the art would recognize that the alarm buzzer 12 disclosed by Kimuia is not suitable for a theft 
10 alarm. The definition of an alaim utilized in these references is not suitable for a theft alarm in 
the context of the present invention in reaction to removal of a device., 

In the Response to Arguments section of the Examiner 's Answer (pages 10-11), 
the Examiner notes that, "reading Cromer's citation the remote computer system or seiver 34 as 
well as software application should be considered as matching the teim 'the device' used in the 
15 claim language and the term should be considered distinct from 'a client' recited by Cromer " 

Appellants note that both the Cromer patent and present disclosure ar e directed to, 
for example, the theft of computers. Cromer teaches many details about microcomputer system 
10 (see, col, 3, line 32, to col, 6, line 46), and teaches that remote computer system 34 has 
components and attributes like those illustrated and described with regard to FIG 3 (col. 6, line 
20 64, to col 7, line 10), Cromer teaches that "the system 10 has a power supply 17" (col, 3, line 
53). A power supply is known in the art to require an external power source, as would be 
appaient to a person of ordinary skill in the art. Cromer, in fact, teaches that "the LAN adapter 
94 is powered by auxiliary voltage (e g, AUX 5) which is present so long as the system 10 is 
connected to AC power (Col 7, lines 64-66; emphasis added.) Cromer does not disclose or 
25 suggest that remote computer system or server 34 will continue to operate after it is removed and 
does not disclose or suggest that the invention will generate an alarm if the remote computer 
system or server 34 is removed , 

First, disconnecting the remote system or server from the network is not 
equivalent to removing the remote computer system or server, and thus the Examiner's 
30 suggestion that the remote computer system or server will generate a signal after 1 being removed 
is pure speculation., A person of ordinary skill in the art would understand that a remote 
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computer system or seiver that has been removed is typically not capable of generating a signal, 
as removing a remote computet system or seiver typically also removes power from the device 
This is especially tine since Cromer teaches that, "if the software application does not get a 
response back after a predetermined number of tries , it indicates to the LAN administrator 
5 through a message that the client at this location is now not attached to the LAN " (Col,7, lines 
44-49.) In this case, Ciomei teaches that there is a delay between the removal of a device and 
the indication to the LAN administrator. 

In addition. Appellants note that the definition of an "alarm" utilized by the 
Examiner is "a signal, by display or audio device " Cromer teaches that remote computer system 
10 or server 34 generates a message for the LAN administrator that the client at this location is now 
not attached to the LAN,. (Col.,7, lines 44-49..) A message is not an alarm until, according to the 
Examiner's definition, it is displayed oi audible Thus, even if the remote computer system or 
server 1 34 generated a message, it is not clear that an alarm would be generated,. The LAN 
administrator' may, for example, be at a console that is no longer connected to remote computer 
15 system or server 34, and that therefore is no longer capable of receiving messages. (If the LAN 
administrator is using the remote computer system or server 34, it is unlikely to be stolen, as 
would be apparent to a person of ordinary skill in the art.) 

Finally, the signal generated by the remote computer' system or server cannot be 
considered an "alarm;" at best, it is a signal to generate an alarm,, As noted above, an alarm is 
20 defined as "an automatic device that serves to call attention, to rouse from sleep> or to warn of 
fire, smoke, an intruder, etc. " Appellants maintain that the signal cited by the Examiner is not 
an "alarm" as defined in the context of the present invention, 

Thus, Thurrott and Cromer et al, alone or in combination, do not disclose or 
suggest generating an alarm in said removed device if said network connection is disconnected, 
25 as required by independent claims 1, 22, 31, and 32, do not disclose or suggest generating an 
alarm in said removed device if said response is not received within a predefined time interval, 
as required by independent claim 12, and do not disclose or suggest generating an alarm in said 
removed device if said signal is no longer received and a theft detection mode is enabled, as 
r equired by independent claim 17 . 
30 In the Response to Arguments section of the Examiner's Answer' (page 15), the 

Examiner 1 appears to equate "a predefined time interval" with not getting a response back "after a 
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predeteimined number of retries. " Appellants note, however, that Cromer does not disclose or 
suggest that the retries are conducted eithei periodically or within a predefined time interval and 
that, therefore, a person of ordinary skill in the ait would not equate "a predefined time interval" 
with "a predeteimined number of retries," 
5 In the Response to Arguments section of the Examiner's Answer (pages 16-17), 

the Examiner asserts that preventing i eduction of a volume below a predefined minimum level 
would have been obvious to one of ordinary skill in the art at the time of the invention given the 
fact that reducing the volume could defeat the purpose of the audio alarm implementation., 

Appellants maintain that the reduction of a volume below a predefined minimum 
10 level is not obvious and that the prior 1 art actually teaches away from the present invention by 
teaching to lower power consumption (i.e., lower the volume of audible devices, etc ) when a 
portable device is removed, for example, from an external power source, as would be apparent to 
a person of ordinary skill in the art, 

In addition, contrary to the Examiner's assertion, preventing silencing is not 
15 equivalent to pieventing the reduction of a volume below a predefined minimum level, and the 
cited prior art does not disclose or suggest a predefined minimum level The fact that Sandei, 
given the alleged special precautions cited by the Examiner; does not disclose or suggest 
pieventing a volume of an audio output of the device from being reduced below a predefined 
minimum level is also evidence that the cited feature would not be obvious to one of ordinal y 
20 skill in the ait at the time of the invention. 

Thus, Thurrott, Ciomei et al., Sanders et al, Lam, Minasi, Pearce et al. 9 and 
Sobell, alone or in any combination, do not disclose or suggest preventing a volume of an audio 
output of the device from being reduced below a predefined minimum level, as required by 
claims 2, 13, 18, and 23, 

25 In the Response to Arguments section of the Examiner's Answer 1 (page 18-20), 

the Examiner asserts that "extending Cromer 's invention with preventing the device from being 
turned off would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention." Regarding Sanders, the Examiner asserts that "not only does the alarm system 
device (Fig. 2-3, object 1010) have no output allowing the device to be turned off, but Sanders 

30 also explicitly discloses an internal batteiy power that prevents turning off the device by lemoval 
of apowei cord (col., 11 lines 49-55) " 
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First, Appellants note that the prior art actually teaches away from the present 

invention by teaching to lower powei consumption (i.e., turn off a device, 01 enter a stand-by 

state) when a portable device is removed, for example, from an external powei source, as would 

be apparent to a person of ordinary skill in the ait., Second, in the text cited by the Examiner, 

5 Sanders teaches that the 

theft detection and alarm system 1010 is also provided with power 
cord 184 having male plug 185 which is adapted to be plugged into a 
conventional power receptacle . Power cord (cable) 184 allows connection of theft 
detection and alarm system 1010 to an external source of AC or DC power Theft 

10 detection and alarm system 1010 comprises power supply circuitry (not shown) 

which generates the voltages needed for the operation thereof!. In a preferred 
embodiment, a rechargeable battery (not shown) is placed within theft detection 
and alarm system 1010. If power cord 184 is disconnected, the internal battery 
powers the components of theft detection and alarm system 101.. Thus, the 

15 removal of power cord 184 does not disable theft detection and alaim system 

1010 

(Col., 11, lines 46-55,) 

Contrary to the Examiner's assertion, Sanders does not disclose or suggest the 
step of preventing said device from being turned off As would be apparent to a person of 
20 ordinary skill in the ait, a thief may attempt to turn off the device to disable the alarm. 

Finally, Appellants could find no disclosure or' suggestion in either Cromer oi 
Minasi to combine the invention disclosed by Cromer and the user rights methods disclosed by 
Minasi,. 

Thus, Thurrott, Cromer 1 et al., Sanders et al., Lam, Minasi, Pearce, and Sobell, 
25 alone or in any combination, do not disclose or suggest preventing said device fiom being turned 
off^ as required by claims 3, 14, 19, and 24 

Conclusion 

The rejections of the cited claims under sections 102 and 103 in view of Thurrott, 
30 Cromer et ai 5 Sanders et al. 5 Lam, Minasi, Pearce, and Sobell, alone or in any combination, are 
therefore believed to be improper and should be withdrawn,. The remaining rejected dependent 
claims are believed allowable for at least the reasons identified above with respect to the 
independent claims., 
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The attention of the Examiner and the Appeal Board to this matter is appreciated 

Respectfully, 

5 Date: Match 30, 2007 Kevin M , Mason 

Attorney for Applicant(s) 
Reg. No. 36,597 
Ryan, Mason & Lewis, LLP 
1300 Post Road, Suite 205 
10 PaiifieId,CT 06824 

(203) 255-6560 
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APPENDIX 

1. A method for detecting removal of a device connected to a network by a network 
connection, comprising: 

monitoring said network connection; and 

generating an alarm in said removed device if said network connection is 

disconnected . 

2, Ihe method of claim 1, further comprising the step of preventing a volume of an 
audio output of said device fr om being r educed below a pr edefined minimum level 

.3 The method of claim 1 , further comprising the step of preventing said device from 

being turned off. 

4 The method of claim 1, wherein said monitoring step is automatically activated in 

a passive manner 

5. The method of claim 1, wherein said monitoring step is manually activated by a 
user 

6. The method of claim 1, wherein said generating step can be prevented by entering 
a password., 

7 . The method of claim 1 ? wherein said monitoring step further comprises the step of 

sending a message to a remote device and awaiting a response, 

8 , The method of claim 1, wherein said monitoring step further comprises the step of 
receiving a message from a remote device. 

9. The method of claim 1, wherein said monitoring step further comprises the step of 
receiving a signal from a remote device . 
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10. The method of claim 1, wherein said monitoring step further comprises the step of 

polling one or more local network ports on said device 

11 The method of claim 1, wherein said generating step is performed only if said 

5 network connection is disconnected by an unauthorized user' 

12. A method for detecting removal of a device connected to a netwoik by a network 

connection, comprising: 

sending a message to a second device connected to said network that will initiate 
10 a response; and 

generating an alarm in said removed device if said response is not received within 
a predefined time interval. 

13 The method of claim 12, further comprising the step of pr eventing a volume of an 
1 5 audio output of said device from being reduced below a predefined minimum level . 

14 The method of claim 12, further' comprising the step of preventing said device 
from being turned off . 

20 15. The method of claim 12, wherein said generating step can be prevented by 

entering a password. 

16., The method of claim 12, wherein said generating step is performed only if said 

network connection is disconnected by an unauthorized user , 

25 

17.. A method for detecting removal of a device connected to a network by a network 

connection, comprising: 

monitoring a signal received on said network connection fiom a remote device 
over said network connection; and 
30 generating an alarm in said r emoved device if said signal is no longer r eceived., 
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18. The method of claim 1 7, further comprising the step of preventing a volume of an 

audio output of said device from being reduced below a predefined minimum level . 

19.. The method of claim 17, further comprising the step of preventing said device 

from being turned off' 

20. The method of claim 17, wherein said geneiating step can be prevented by 
entering a password 

21 . The method of claim 17, wherein said genet ating step is performed only if said 
network connection is disconnected by an unauthorized user. 

22,. A system for detecting removal of a device connected to a network by a network 

connection, comprising: 

a memory that stores computer -readable code; and 

a processor operatively coupled to said memory, said processor configured to 
implement said computer-readable code, said computer -readable code configured to: 
monitor said network connection; and 

generate an alarm in said removed device if said network connection is 

disconnected 

23 The system of claim 22, wherein said processor is further configured to prevent a 

volume of an audio output of said device fr om being reduced below a predefined minimum level. 

24,. The system of claim 22, wherein said processor is further configured to prevent 

said device from being turned off . 

25 , The system of claim 22, wherein said processor 1 is further configured to prevent 

said alarm by entering a password, 
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26. The system of claim 22, wherein said processor' is further configured to send a 

message to a remote device and await a response. 

27., The system of claim 22, wherein said processor is further configuied to receive a 

5 message from a remote device, 

28., The system of claim 22, wherein said processor is further configuied to receive a 

signal from a remote device, 

10 29. The system of claim 22, wherein said processor is further configured to poll one 

or' more local network ports on said device, 

30, The system of claim 22 ? wherein said processor is further configured to generate 

said alarm only if said network connection is disconnected by an unauthorized user, 

15 

3 1 An article of manufacture for detecting removal of a device connected to a 

network by a network connection, comprising: 

a computer readable medium having computer readable code means embodied 
thereon, said computer readable program code which when executed 
20 implements the steps of: 

a step to monitor said network connection; and 

a step to generate an alarm in said removed device if said network connection is 

disconnected 

25 32 . A system for detecting removal of a device connected to a network by a network 

connection, comprising: 

means for monitoring said network connection; and 

means for generating an alarm in said removed device if said network connection 
is disconnected . 
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EVIDENCE APPENDIX 
There is no evidence submitted pursuant to § 1 130, 1.131, or 1 1.32 or entered by 
the Examinei and relied upon by appellant. 
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RELATED PROCEEDINGS APPENDIX 
There are no known decisions rendered by a court 01 the Board in any proceeding 
identified pursuant to paragraph (c)(l)(ii) of 3 7 CFR 41 .37. 
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